Description

The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.

Remediation

References

CVE-2005-0453

Related Vulnerabilities

WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions Security Bypass (2.3.2)

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.20)

IBM RTC Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-7440)

WordPress Plugin Telugu Bible Verse Daily Cross-Site Request Forgery (1.0)

Oracle Database Server CVE-2017-10120 Vulnerability (CVE-2017-10120)

Severity

Medium

Classification

CVE-2005-0453

Tags

Missing Update Known Vulnerabilities